release(runway): cherry-pick fix: cp-13.11.0 replace deeplink with signed link (#38326)

- fix: cp-13.11.0 replace deeplink with signed link (#38270)

<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**
Use signed links for qr code
<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

[![Open in GitHub

Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/38270?quickstart=1)

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: null

## **Related issues**

Fixes:

## **Manual testing steps**

1. Go to this page...
2.
3.

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding

Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling

guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Switch QR code to signed onboarding URLs (Apple/Google/SRP) selected
by socialType and update tests accordingly.
> 
> - **UI – `ui/components/app/rewards/RewardsQRCode.tsx`**:
> - Use signed URLs for QR data via `APPLE_ONBOARDING_URL`,
`GOOGLE_ONBOARDING_URL`, and `SRP_ONBOARDING_URL` based on `socialType`.
>   - Import new constants from `./utils/constants`.
> - **Tests – `ui/components/app/rewards/RewardsQRCode.test.tsx`**:
> - Update assertions to compare against signed URLs from constants
(accounting for HTML entity encoding).
>   - Add test case for Apple social type.
> - **Constants – `ui/components/app/rewards/utils/constants.ts`**:
> - Add signed onboarding URL constants: `GOOGLE_ONBOARDING_URL`,
`APPLE_ONBOARDING_URL`, `SRP_ONBOARDING_URL`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
58fb6e4. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->


[85115d6](85115d6)

Co-authored-by: sophieqgu <[email protected]>

Author: runway-github[bot]

ui/components/app/rewards/RewardsQRCode.test.tsx

@@ -5,6 +5,11 @@ import { useSelector, useDispatch } from 'react-redux';
 import { setOnboardingModalOpen } from '../../../ducks/rewards';
 import { getSocialLoginType } from '../../../selectors/seedless-onboarding/social-sync';
 import RewardsQRCode from './RewardsQRCode';
+import {
+  GOOGLE_ONBOARDING_URL,
+  SRP_ONBOARDING_URL,
+  APPLE_ONBOARDING_URL,
+} from './utils/constants';
 
 // Mock react-redux hooks
 jest.mock('react-redux', () => ({
@@ -78,7 +83,7 @@ describe('RewardsQRCode', () => {
     expect(mockUseSelector).toHaveBeenCalledWith(getSocialLoginType);
   });
 
-  it('encodes socialType in QR data when provided', () => {
+  it('encodes Google socialType in QR data when provided', () => {
     mockUseSelector.mockImplementation((selector) => {
       if (selector === getSocialLoginType) {
         return 'google';
@@ -91,9 +96,25 @@ describe('RewardsQRCode', () => {
     const qrImageContainer = screen.getByTestId('qr-code-image');
     expect(qrImageContainer).toBeInTheDocument();
     // The inner HTML is produced by our qr generator mock and includes data-qr
-    expect(qrImageContainer.innerHTML).toContain(
-      'data-qr="https://link.metamask.io/onboarding?type=google&existing=true"',
-    );
+    // InnerHTML encodes ampersands, so compare against encoded version
+    const encoded = GOOGLE_ONBOARDING_URL.replaceAll('&', '&');
+    expect(qrImageContainer.innerHTML).toContain(`data-qr="${encoded}"`);
+  });
+
+  it('encodes Apple socialType in QR data when provided', () => {
+    mockUseSelector.mockImplementation((selector) => {
+      if (selector === getSocialLoginType) {
+        return 'apple';
+      }
+      return undefined;
+    });
+
+    render(<RewardsQRCode />);
+
+    const qrImageContainer = screen.getByTestId('qr-code-image');
+    expect(qrImageContainer).toBeInTheDocument();
+    const encoded = APPLE_ONBOARDING_URL.replaceAll('&', '&amp;');
+    expect(qrImageContainer.innerHTML).toContain(`data-qr="${encoded}"`);
   });
 
   it('defaults to SRP flow in QR data when socialType is absent', () => {
@@ -108,9 +129,8 @@ describe('RewardsQRCode', () => {
 
     const qrImageContainer = screen.getByTestId('qr-code-image');
     expect(qrImageContainer).toBeInTheDocument();
-    expect(qrImageContainer.innerHTML).toContain(
-      'data-qr="https://link.metamask.io/onboarding?type=srp"',
-    );
+    const encoded = SRP_ONBOARDING_URL.replaceAll('&', '&amp;');
+    expect(qrImageContainer.innerHTML).toContain(`data-qr="${encoded}"`);
   });
 
   it('dispatches close action when clicking Got it', () => {

ui/components/app/rewards/RewardsQRCode.tsx

@@ -13,6 +13,11 @@ import { getSocialLoginType } from '../../../selectors/seedless-onboarding/socia
 import { useI18nContext } from '../../../hooks/useI18nContext';
 import { setOnboardingModalOpen } from '../../../ducks/rewards';
 import { ModalBody } from '../../component-library/modal-body/modal-body';
+import {
+  APPLE_ONBOARDING_URL,
+  GOOGLE_ONBOARDING_URL,
+  SRP_ONBOARDING_URL,
+} from './utils/constants';
 
 const QrCodeView = ({ data }: { data: string }) => {
   const qrImage = qrCode(0, 'M');
@@ -48,11 +53,12 @@ export default function RewardsQRCode() {
   }, [dispatch]);
 
   const dataToEncode = useMemo(() => {
-    if (socialType) {
-      return `https://link.metamask.io/onboarding?type=${socialType}&existing=true`;
+    if (socialType === 'apple') {
+      return APPLE_ONBOARDING_URL;
+    } else if (socialType === 'google') {
+      return GOOGLE_ONBOARDING_URL;
     }
-
-    return `https://link.metamask.io/onboarding?type=srp`;
+    return SRP_ONBOARDING_URL;
   }, [socialType]);
 
   return (

ui/components/app/rewards/utils/constants.ts

@@ -1,2 +1,8 @@
 export const REWARDS_GTM_MODAL_SHOWN = 'REWARDS_GTM_MODAL_SHOWN';
 export const REWARDS_BADGE_HIDDEN = 'REWARDS_BADGE_HIDDEN';
+export const GOOGLE_ONBOARDING_URL =
+  'https://link.metamask.io/onboarding?sig_params=type&type=google&sig=S5CFw2lW6WfLMA9ksQyqKoGNevtCHoSxqbTc4uuc8UpG4qrkLfZnUT31_dK5KWVmalm_j0RBCsJElzg_9XnB4A';
+export const APPLE_ONBOARDING_URL =
+  'https://link.metamask.io/onboarding?existing=true&sig_params=existing%2Ctype&type=apple&sig=XnjGKreBsg7pEP-P9NYKmJ1lNYr_GQcfT8kUMF70B9s9tG9X9vCzZ6ghLZWFqGxlmztCYQraRhOgSj7TKQrlpw';
+export const SRP_ONBOARDING_URL =
+  'https://link.metamask.io/onboarding?sig_params=type&type=srp&sig=nwtLGtTMWX8DFUBZaFtqONyo2gp2pglsaymliHaf5UJ4Z42H79N6d9gT-7lXq0Tk0ldaQjvKyiagABBX9eZ8bQ';